CVE-2026-80204

CVE-2026-80204 affects the Grav API plugin (getgrav/grav-plugin-api) before 1.0.18 . The root cause lies in the injectSecurityTab() function of BlueprintController, which performs raw isSuperAdmin()/hasPermission() checks without a request parameter, preventing enforcement of scopeAllows(). As a ...

PYSEC-2014-44

Cross-site scripting XSS vulnerability in safehtml.py in Plone before 4.2.3 and 4.3 before beta 1 allows remote authenticated users with permissions to edit content to inject arbitrary web script or HTML via unspecified vectors...